Incorporating Privileged Information to Unsupervised Anomaly Detection

TL;DR

This paper presents SPI, a novel ensemble method for unsupervised anomaly detection that leverages privileged information available only during training to improve detection accuracy across various scenarios.

Contribution

The paper extends the LUPI paradigm to unsupervised anomaly detection, introducing SPI, which effectively utilizes privileged information for enhanced detection performance.

Findings

Augmenting privileged information improves detection accuracy.

SPI performs well with domain knowledge, expensive features, and future data.

Extensive experiments validate the effectiveness of the approach.

Abstract

We introduce a new unsupervised anomaly detection ensemble called SPI which can harness privileged information - data available only for training examples but not for (future) test examples. Our ideas build on the Learning Using Privileged Information (LUPI) paradigm pioneered by Vapnik et al. [19,17], which we extend to unsupervised learning and in particular to anomaly detection. SPI (for Spotting anomalies with Privileged Information) constructs a number of frames/fragments of knowledge (i.e., density estimates) in the privileged space and transfers them to the anomaly scoring space through "imitation" functions that use only the partial information available for test examples. Our generalization of the LUPI paradigm to unsupervised anomaly detection shepherds the field in several key directions, including (i) domain knowledge-augmented detection using expert annotations as PI, (ii) fast detection using computationally-demanding data as PI, and (iii) early detection using "historical future" data as PI. Through extensive experiments on simulated and real datasets, we show that augmenting privileged information to anomaly detection significantly improves detection performance. We also demonstrate the promise of SPI under all three settings (i-iii); with PI capturing expert knowledge, computationally expensive features, and future data on three real world detection tasks.